Skip to main content

Definition

Assembly: Microsoft.OData.Mcp.Authentication.dll Namespace: Microsoft.OData.Mcp.Authentication.Outbound Inheritance: System.Object

Syntax

Summary

The durable, single-slot SDK ITokenCache for outbound OAuth, backed by the operating system credential store through Latchkey so a restart of the same service root and client id does not re-prompt the operator.

Remarks

Per AUTH-7 this implements the SDK interface directly; it is never wrapped in a new ICredentialStore or IOutboundTokenCache abstraction. Per AUTH-12 no access token, refresh token, or client secret ever reaches a log sink: every log line that mentions a token routes through TokenContainer). The backend map is pinned rather than left at Auto’s native seed, because Windows Credential Manager caps a value at 2560 bytes — smaller than a typical TokenContainer. Windows therefore uses DPAPI-sealed files, macOS the Keychain, Linux the Secret Service, and every platform falls back to a plain file store.

Examples

Constructors

.ctor

Initializes a new instance of the LatchkeyTokenCache class over the operating system credential store selected for the current platform.

Syntax

Parameters

Exceptions

Examples

Remarks

The backing store is created eagerly, so an unusable credential store surfaces at construction rather than on the first OData request. Call String) before constructing to fail first with an actionable message instead.

.ctor Inherited

Inherited from object

Syntax

Methods

ClearAsync

Removes this cache’s slot from the credential store, so the next start runs a fresh grant.

Syntax

Parameters

Returns

Type: System.Threading.Tasks.Task A task that completes once the slot is gone, whether or not it existed.

Examples

ComputeKey

Computes the Latchkey key a service root and client id pair caches its tokens under.

Syntax

Parameters

Returns

Type: string The lowercase hex SHA-256 digest of serviceRoot.AbsoluteUri + "\n" + clientId, always 64 characters long.

Exceptions

Examples

Remarks

The newline separator keeps the two inputs unambiguous, so a service root that ends with the text of a client id cannot collide with a different pair. The digest is deterministic across processes and platforms, which is what lets a restart find the slot the previous run wrote.

Equals Inherited Virtual

Inherited from object

Syntax

Parameters

Returns

Type: bool

Equals Inherited

Inherited from object

Syntax

Parameters

Returns

Type: bool

GetHashCode Inherited Virtual

Inherited from object

Syntax

Returns

Type: int

GetTokensAsync

Reads the cached token container for this cache’s service root and client id.

Syntax

Parameters

Returns

Type: System.Threading.Tasks.ValueTask<ModelContextProtocol.Authentication.TokenContainer?> The cached container, or null when nothing is cached or the cached bytes could not be read back as a usable container.

Exceptions

Examples

Remarks

An entry the store cannot unprotect, or that is not valid JSON, deserializes to null, or carries no access token, is unusable — the DPAPI master key may have changed, or a previous write may have been truncated. Such an entry is deleted and reported at warning level naming only Key, never the payload, so the caller falls through to a fresh grant instead of failing repeatedly. A LatchkeyBackendUnavailableException is deliberately excluded from that handling and propagates instead. It reports that the whole store became unusable after construction — a locked Secret Service keyring, a cache directory that lost its permissions — not that this entry is corrupt. Treating it as corruption would misdescribe the fault and, where reads fail while deletes succeed, would destroy a still-valid refresh token over a transient condition.

GetType Inherited

Inherited from object

Syntax

Returns

Type: System.Type

MemberwiseClone Inherited

Inherited from object

Syntax

Returns

Type: object

ReferenceEquals Inherited

Inherited from object

Syntax

Parameters

Returns

Type: bool

StoreTokensAsync

Writes a token container into this cache’s single slot, replacing whatever it held.

Syntax

Parameters

Returns

Type: System.Threading.Tasks.ValueTask A task that completes once the container is durable in the credential store.

Exceptions

Examples

Remarks

The whole container is persisted, including ClientId, ClientSecret, TokenEndpointAuthMethod, and AuthorizationServer, so a cold start can refresh without re-running dynamic client registration.

ToString Inherited Virtual

Inherited from object

Syntax

Returns

Type: string?

VerifyPersistence

Reports whether the credential store this cache would use can actually round-trip a value on this host.

Syntax

Parameters

Returns

Type: bool true when a throwaway value survives a write, read, and delete; otherwise false.

Examples

Remarks

Call this at startup, before constructing the cache, so an unusable keyring fails first with an actionable message rather than midway through a grant. It never throws: a store that cannot be reached reports false.
  • ModelContextProtocol.Authentication.ITokenCache